Selfie search and face data: what's changing
From 1 November, the face data that makes selfie search work is deleted automatically 12 months after each photo is uploaded. Your photos stay exactly where they are. Privacy laws require a fixed limit like this, so it isn't something we can leave out.
How it works
Every photo follows the same simple path. The clock is per photo: it starts when that photo is uploaded.
Day 1
A photo is uploaded
Faces in it are turned into face data, so buyers can find it with a selfie.
For 12 months
Selfie search finds it
Buyers take a selfie and see every photo they're in, just like today.
At 12 months
Its face data is deleted
Automatically and permanently. The photo is never face-indexed again.
After that
The photo carries on
Buyers can still find it by bib number, time or browsing, and buy and download it.
Face data isn't the photo
Face data is a set of numbers describing the faces in a photo: a face template. It's only used to match a buyer's selfie. Deleting it removes the template and nothing else.
What happens on 1 November
Photos uploaded more than 12 months ago are already past the limit, so they're dealt with first.
Older photos lose their face data first
Face data for photos uploaded more than 12 months ago is deleted from 1 November. We work through them in batches, so it can take a few days to reach every gallery. From 1 November, no new face data is created for those photos.
Then a daily check
After that, an automated job runs every day and deletes each photo's face data as it reaches 12 months. Nothing to set up and nothing to remember.
When a whole gallery is past 12 months
Selfie search ends for that gallery. Buyers who try it see a short note that points them to bib search and browsing instead.
Closed galleries, or selfie search switched off
Face data is deleted 30 days after a gallery is closed or its selfie search is switched off. For galleries already closed or switched off before 1 November, those 30 days start on 1 November.
What doesn't change
Deleting face data never deletes a photo. Everything else carries on as it is today:
- Your photos and galleries
- Sales, orders and your earnings
- Downloads, including free-download galleries
- Bib and number search, and text search
- Time search and browsing
- Selfie search on photos uploaded in the last 12 months
What your buyers will notice
Most buyers look for their photos in the days and weeks after an event, so most won't notice anything.
- Selfie search won't find photos uploaded more than 12 months ago.
- They can still find those photos by bib number, time or browsing the gallery, and buy and download them as usual.
- In a gallery where every photo is older than 12 months, selfie search shows a short note pointing them to the other ways to search.
- Selfies used to search are still never stored, as today.
A good habit: remind buyers to search soon after each event, in your event emails or social posts.
Why this is happening
We don't have much control over this. It comes from privacy law, not from a decision to cut back selfie search.
Face templates are biometric data, which privacy laws treat as some of the most sensitive personal data there is. Those laws say it must have a fixed, published retention limit, be kept no longer than it's needed, and then be deleted automatically. Keeping face data indefinitely isn't an option for anyone who offers face search.
Photohawk galleries are used all over the world, so one rule has to work under all of these laws at once:
- GDPR and UK GDPR
- Biometric data used to identify people is a special category of personal data, and the storage-limitation principle says it must be kept no longer than necessary.
- Illinois (BIPA)
- Requires a public written retention schedule and destruction of biometric data once its purpose is met, with fixed deadlines.
- Texas (CUBI)
- Biometric identifiers must be destroyed within a reasonable time, and no later than a year after the purpose for collecting them ends.
- Colorado
- Biometric data must be deleted once its purpose is met, with fixed outer deadlines and a yearly review.
- Washington
- Biometric identifiers may be kept no longer than reasonably necessary to provide the service.
The one thing we could choose was the length. We chose 12 months: long enough to cover the time when buyers look for their photos, and within the deadlines these laws set.
This page explains how Photohawk handles face data. It isn't legal advice.
Questions
No. Only the face data used for selfie search is deleted. Photos, galleries, sales, orders and downloads are not affected.
No. It all happens automatically. If you like, remind buyers to search soon after each event.
No. The 12-month limit applies to every gallery on Photohawk, worldwide, and we can't make exceptions: a fixed limit that applies to everyone is exactly what these laws ask for.
Yes. Switch off selfie search for a gallery, or close it, and its face data is deleted 30 days later. Switch it back on within those 30 days and that deletion is cancelled.
Anyone can ask at any time, in the gallery (selfie search, then "Make a request") or by emailing support@photohawk.com. Their face data is deleted within 30 days, and you can also do it straight away from the gallery's selfie search settings.
By bib or number search, time search or browsing the gallery, exactly as today. Only selfie search stops finding them.
No. A selfie is used only for that one search and then discarded, as it is today.
No. It's the same for every plan and every gallery.
The full details
Our face-data policy sets out exactly what face data we keep, for how long, and how it's deleted. Questions? Email us and a real person will reply.